CVE-2021-28162 Command Injection in @theia/messages
Attackers can execute arbitrary JavaScript via unescaped HTML in notification messages within the Eclipse Theia IDE.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-28162?
CVE-2021-28162 is a medium-severity cross-site scripting vulnerability in Eclipse Theia, published on 12 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Which versions are affected by CVE-2021-28162?
2 open source packages ship an affected version, including @theia/messages. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@theia/messages npm | All versions | 1.0.0 |
@theia/messages npm | All versions | 1.0.0 |
Products include Eclipse Theia.
How do I fix CVE-2021-28162?
Upgrade @theia/messages to 1.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-28162 being exploited?
There is no known exploitation of CVE-2021-28162 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Theia
- CVE-2021-34436 XML external entity in Eclipse Theia
- CVE-2020-27224 Cross-site Scripting (XSS) in Eclipse Theia
- CVE-2026-60009 File upload in Eclipse Theia
- CVE-2021-34435 Remote code execution in Eclipse Theia
- CVE-2026-44688 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Sources
Also known as GHSA-c94v-8fff-73ph.